The vulnerability is a use‑after‑free in ksmbd_sessions_deregister() that can be triggered when a second SMB channel sets up a session while the first channel is still active. The freed session in the global session table can still be accessed through the connection’s session list, leading to kernel memory corruption. Because the code runs in privileged kernel space, an attacker could potentially craft SMB traffic to drive corrupted data into executable paths, allowing arbitrary code execution or a denial‑of‑service by crashing the kernel. The flaw is categorized as CWE‑416.

All Linux kernels that include the ksmbd SMB server component are potentially affected. The specific release numbers are not listed in the data, but a patch commit is referenced in the kernel git log and a Debian LTS announcement indicates they will be patched in upcoming releases.

The CVSS score of 8.8 indicates a high impact, but the EPSS score of <1% signals that the likelihood of exploitation in the wild is currently very low. The flaw is not listed as a Known Exploited Vulnerability by CISA, so active exploitation is not confirmed. Attackers would need to reach the PSM server over SMB, either locally on the machine or remotely if the service is exposed, to send crafted requests that exercise the UAF path. No official workaround is supplied by the CNA.